Single Sign On Setup

SSO Basic Settings

Toggle Enable Single Sign On? on once you're ready to launch SSO on your site. You can complete SSO setup before enabling.

Set your SSO Type to:

• SAML (includes Shibboleth)

• CAS

• JWT

• OAuth

Set your SSO Logout Url. This is the URL your users will be redirected to after logging out.

SAML stands for Security Assertion Markup Language. It is an out-of-the-box, industry standard for SSO, and it's the easiest and most secure way to set up SSO on your PeopleGrove site. This is our preferred method for implementing SSO.

If you're setting up your SSO via SAML, you'll need to complete the following fields:

The Entity ID is in the first line of your metadata, as shown in the image below:

SAML Redirect is the SAML HTTP Redirect URL. In the metadata, it is often referred to as 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' and normally ends in '/SAML2/Redirect/SSO'. In the example below, the SAML redirect is the URL on the highlighted "Location" line. Only include the URL starting with 'https://...' and do not include quotes or any other characters:

In this example, we would enter the following into the SAML Redirect field:

     https://shibb-idp.georgetown.edu/idp/profile/SAML2/Redirect/SSO

Your SAML Certificate is the signing certificate from the SAML metadata. There may be multiple certificates in your metadata file, so search for "signing" in the metadata to find the correct section. Once you've found it, copy-and-paste the entire string. Whitespace will not matter. If the certificate you have is in a file, simply open the file with a text editor. 

The ADFS toggle is an optional setting. Only enable this setting if you are using Active Directory Federation Services with SAML. Note: ADFS may be included in the entity ID.

Disable AuthnContext toggle is also an optional setting. We normally recommend keeping this setting disabled, but if you experience any issues with your login page, try enabling this setting to disable the AuthnContext being passed from the PeopleGrove request. 

Leave the Advanced: Accepted Clock Skew (Ms) field blank. If your SSO is set up correctly but your end users are encountering errors, our support team may use this field to resolve the issue.

CAS stands for Central Authentication Service. It is similar to SAML but is an older standard. Otherwise, there isn't much difference between SAML and CAS.

If you're setting up your SSO via CAS, you'll need to complete the following fields:

• CAS Server Address 
• Version Of CAS 
• All CAS requests will be redirected to

Enter the base URL of your CAS server into the CAS Server Address field. Do not include  /login in the URL. An example of this is https://login.test.edu/cas.

Next, set the version of CAS you're using in the Version of CAS dropdown menu. We support CAS 1.0, CAS 2.0, and CAS 3.0. If you're unsure of which version you're using, you're most likely using CAS 2.0.

Now that your CAS settings are set, jump down to the Mapping Your Attributes section of this support article by clicking here.

If you're setting up your SSO via JWT, you'll need to complete the following fields:

• Login URL 
• JWT Secret
• URL where all requests are redirected (though not specifically a field)

The Login URL should be the URL of the SSO login page. If an end-user clicks the SSO button from your PeopleGrove site's landing page, they'll be brought to the URL entered here.

Once you've set your SSO type settings and generated your attributes, you'll need to map them to their corresponding PeopleGrove fields. We support mapping to the following fields:

• SSO ID
• Database Key
• First Name
• Last Name
• Email
• Affiliations
• Custom Fields
• Education Records

Required Attributes

You'll want to create attributes for the first five fields. While it's possible to pull additional data via SSO, the final three fields are optional.

When a user logs in via SSO, the system will check your PeopleGrove site for an associated user account. The system checks for accounts with a matching SSO ID, then Database Key, then Email, so make sure to create attributes for each of those.

Note: While we highly recommend creating unique attributes for each of these fields, it is possible to assign the same attribute to multiple fields. If, for example, your organization does not have a dedicated ID to use for SSO ID, you can set users' database keys as their SSO IDs.

Be aware that all users must have a value set for SSO ID. If you do not map any attributes to this field, it will prevent your users from logging in.

In order for a new user account to be created, the system requires a first name, last name, and email address. This is the minimum amount of information required to create a new account, so make sure to include attributes for these fields in your metadata if you expect any users who have not been imported to sign up via SSO.

Keep in mind that you must create separate attributes for First Name and Last Name. If you create one attribute that pulls the user's full name and add it to both fields, the user's full name will appear twice on their profile (e.g. "John Smith John Smith").

Once you have entered values for the required fields, click the Save button, then continue on to testing the SSO configuration. If you would like to map attributes to the optional fields, though, proceed to the next section.

Optional Attributes

Affiliations allows you to prevent your users from signing up as the wrong user type.

You'll need to create an attribute that pulls what the user's user type should be (for example, student, alumni, etc.) and map it to the Affiliations field. Then, you'll need to reach out to our support team (by clicking the green question mark in the bottom right-hand corner of the SSO page on your PeopleGrove site) and let us know which affiliations you've set up. Our team will map those to the correct user types.

Once that's set, a user can select any user type they want during sign up, but if they select a user type other than the user type you've assigned to them (in the SSO), they will be placed in the approval queue and will require admin approval before accessing the site.

Please keep in mind that this does not assign user types. 

If you wish to pull user data from your end to answer any Custom Fields, enter the attribute in the field on the left, and select the corresponding custom field question from the drop-down menu on the right.

If you would like to map Education Records via SSO, toggle Enabled Education Mapping on. This will bring up some new fields:

Once you have entered values for each field, click the Save button, and continue on to testing the SSO configuration.